citybee[.]life

This domain, citybee.life, is identified as a brand impersonation threat specifically targeting Facebook users. The site replicates the Facebook login page, presenting a near-identical interface to deceive visitors into entering their credentials. Such impersonation attacks are designed to harvest login details, which can then be exploited for unauthorized account access, financial fraud, or further social engineering campaigns. The risk is elevated due to the direct targeting of a high-profile platform with billions of active users, increasing the potential impact of successful credential theft. Analysis indicates that citybee.life was registered on December 29, 2025, through Name.com, Inc., a domain registrar commonly utilized for both legitimate and malicious purposes. The domain resolves to the IP address 13.61.185.157, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in Sweden. At the time of assessment, the domain was flagged by 17 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. Additionally, the domain appears on one security blocklist and lacks an SSL certificate, further signaling its suspicious nature. The absence of encryption and the use of recently registered infrastructure are consistent with patterns observed in credential theft campaigns. Individuals who visited citybee.life or entered credentials on the site should take immediate remedial actions. First, change the password for the affected Facebook account and any other platforms where the same credentials were reused. Enable multi-factor authentication (MFA) to add an additional layer of security. Monitor the account for unauthorized activity, such as unfamiliar logins, messages sent without consent, or changes to account settings. If financial information was entered, contact the relevant institution to report potential fraud. Users should also scan their devices for malware, as some credential theft campaigns deploy additional payloads to maintain persistence. Finally, report the domain to Facebook’s abuse channels and relevant cybersecurity organizations to aid in takedown efforts and prevent further victimization.